Information Security Policy (ISMS)

1. Purpose and scope

This policy establishes the Information Security Management System (ISMS) of UNCLETIM DIGITAL SOLUTIONS LTD, structured on ISO/IEC 27001:2022 (including its Annex A controls) and aligned with the security obligations in the Company’s agreements with 9 Payment Service Bank. It applies to all staff, systems, premises, and third parties handling Company or customer information.

2. Governance

• The Director owns the ISMS, approves security policies, and reviews security performance and incidents at least quarterly.
• All staff must complete security awareness training and comply with this policy; violations may attract disciplinary action.
• A risk register is maintained and reviewed quarterly; controls are selected through documented risk assessment.

3. Core controls

• Access control: unique user IDs, least privilege, MFA mandatory for remote, administrative, cloud, and banking access (see the Access Management and MFA Policy).
• Cryptography: TLS 1.2 or higher in transit; AES-256 encryption at rest; API keys and secrets held in a credential vault and rotated at least every 90 days.
• Logging and monitoring: security logs retained for a minimum of two (2) years; fraud alerts from 9PSB acknowledged within 1 hour and acted on within the timelines in the Incident Response Plan.
• Vulnerability management: systems patched promptly; an independent penetration test is performed at least annually.
• Supplier security: third parties undergo due diligence and are bound by written data-protection and confidentiality terms.

• Physical and endpoint security: devices encrypted, screen-locked, and protected by reputable endpoint security software.
• Backup: business data backed up daily to cloud services, with restoration tested periodically.

4. Continual improvement

The ISMS, its risk assessments, and this policy are reviewed at least annually and after any significant incident or change, and corrective actions are tracked to completion by the Director.